build: run all linting in Docker via Dockerfile.lint (closes #104)

Conversation 6 Commits 2 Files Changed 7

+109 -76

2 Commits

Author	SHA1	Message	Date
sneak	f1c1bffb5a	build: stop installing golangci-lint on the host check / check (push) Failing after 0s Details The linter runs only inside the pinned golangci-lint container image (Dockerfile.lint, and the Dockerfile lint stage). Remove the host install that was still left behind: script/bootstrap's version and sha256 pins, the release download, the ensure/verify helpers, and the curl dependency they were the only user of; and drop golangci-lint from the nix-shell package lists in the Makefile and script/test, which build and test but never lint. Model: opus-4-8	2026-09-21 22:48:51 +00:00
sneak	557b4f621a	build: run all linting in Docker via Dockerfile.lint (closes #104 ) golangci-lint now runs only inside a container, never on the host. script/lint builds a hash-pinned root Dockerfile.lint; the nix-shell and host golangci-lint paths are gone. A per-run CACHEBUST build-arg is folded into the lint step's cache key, so the linter re-executes on every run and an unchanged tree cannot return a cached success having linted nothing; script/lint fails a build that did not run the linter. Dockerfile's lint stage runs golangci-lint directly, since make lint now builds a container and there is no Docker inside a build. It is the same image and config. golangci-lint config verify is left out: it fetches its schema over an unpinned live HTTPS call, which REPO_POLICIES.md forbids. Model: opus-4-8	2026-09-21 22:48:51 +00:00

Author

SHA1

Message

Date

sneak

f1c1bffb5a

build: stop installing golangci-lint on the host

check / check (push) Failing after 0s

Details

The linter runs only inside the pinned golangci-lint container image
(Dockerfile.lint, and the Dockerfile lint stage). Remove the host
install that was still left behind: script/bootstrap's version and
sha256 pins, the release download, the ensure/verify helpers, and the
curl dependency they were the only user of; and drop golangci-lint from
the nix-shell package lists in the Makefile and script/test, which build
and test but never lint.

Model: opus-4-8

2026-09-21 22:48:51 +00:00

sneak

557b4f621a

build: run all linting in Docker via Dockerfile.lint (closes #104 )

golangci-lint now runs only inside a container, never on the host.
script/lint builds a hash-pinned root Dockerfile.lint; the nix-shell and
host golangci-lint paths are gone. A per-run CACHEBUST build-arg is
folded into the lint step's cache key, so the linter re-executes on every
run and an unchanged tree cannot return a cached success having linted
nothing; script/lint fails a build that did not run the linter.

Dockerfile's lint stage runs golangci-lint directly, since make lint now
builds a container and there is no Docker inside a build. It is the same
image and config. golangci-lint config verify is left out: it fetches its
schema over an unpinned live HTTPS call, which REPO_POLICIES.md forbids.

Model: opus-4-8

2026-09-21 22:48:51 +00:00

build: run all linting in Docker via Dockerfile.lint (closes #104) #122